AI Triage
A rule can match code that looks like a violation but isn't, in context. AI Triage re-checks every flagged violation for exploitability, reachability, and mitigating context before it reaches your issue inbox.
It checks three things:
Applicability - does the flagged file's role make the rule's control possible at all?
Reachability - who can reach the flagged code at runtime?
Mitigations - does an existing control upstream already handle this?
Each check carries a confidence score, so a low-confidence result never gets auto-dismissed - it surfaces for you to triage instead.
How AI Triage prioritizes issues
The same three checks also score each finding's effective severity using the context established above. This ensures that only real issues & findings land in your inbox.
Learning from your dismissal notes
When you dismiss a finding with a reason and note, Dam Secure can turn that into lasting security context for the repository. Later AI Triage runs use that context alongside what it learns from the code.
This is especially valuable for controls that live outside the repository (for example, "rate limiting is enforced at the load balancer"), which Dam Secure cannot observe directly in the codebase.
What happens to the finding
| Result | What you see |
|---|---|
| No applicability, reachability, or mitigation issue found | Surfaces normally for triage |
| Limited reachability, or a mitigation that reduces but does not remove the risk | Surfaces with a lower severity |
| AI Triage cannot reach a confident answer | Surfaces normally for triage |
| AI Triage finds a citable reason the finding is not exploitable, with high confidence | Auto-dismissed |
Auto-dismissed findings
Dam Secure automatically dismisses a finding when AI Triage finds a high-confidence, citable reason it isn't exploitable. Dismissed findings are marked in the Issues view.
If you disagree with an auto-dismissal, restore it the same way you restore any other dismissed sub-issue. See Triaging Sub-issues.